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FOREWORD 



While conflict in cyberspace is not a new phenom- 
enon, the legality of hostile cyber activity at a state lev- 
el remains imperfectly defined. While there is broad 
agreement among the United States and its allies that 
cyber warfare would be governed by existing law of 
armed conflict, with no need for additional treaties 
or conventions to regulate hostilities online, this view 
is not shared by many nations that the United States 
could potentially face as adversaries. 

A range of foreign states use definitions for cyber 
conflict that are entirely different from our own, ex- 
tending to different concepts of what constitutes on- 
line hostilities and even a state of war. This leads to 
a potentially dangerous situation where an adversary 
could be operating according to an entirely different 
understanding of international law to that followed 
by the United States. 

In this Letort Paper, Mr. Keir Giles uses Russian- 
language sources and interviews to illustrate the 
very distinct set of views on the nature of conflict 
in cyberspace that pertains to Russia. He provides 
an important window into Russian thinking and 
explains how fundamental Russian assumptions 
on the nature of cyber activity need to be consid- 
ered when countering, or engaging with, Russian 
cyber initiatives. 

The Strategic Studies Institute is pleased to of- 
fer this detailed analysis as an essential guide to the 
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mindset of an important cyber actor, and one which it 
is essential for the United States to understand. 




DOUGLAS C. LOVELACE, JR. 
Director 

Strategic Studies Institute and 
U.S. Army War College Press 
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SUMMARY 



The United States and its allies are in general 
agreement on the legal status of conflict in cyberspace. 
Although key principles remain unresolved, such 
as what precisely constitutes an armed attack or use 
of force in cyberspace, overall there is a broad legal 
consensus among Euro-Atlantic nations that existing 
international law and international commitments are 
sufficient to regulate cyber conflict. 

This principle is described in multiple authoritative 
legal commentaries. But these can imply misleadingly 
that this consensus is global and unchallenged. In fact, 
China, Russia, and a number of like-minded nations 
have an entirely different concept of the applicability 
of international law to cyberspace as a whole, includ- 
ing to the nature of conflict within it. These nations 
could therefore potentially operate in cyberspace ac- 
cording to entirely different understandings of what 
is permissible under international humanitarian law, 
the law of armed conflict, and other legal baskets gov- 
erning conduct during hostilities. 

U.S. policymakers cannot afford to underestimate 
the extent to which Russian concepts and approaches 
differ from what they may take for granted. This in- 
cludes the specific question of when, or whether, hos- 
tile action in cyberspace constitutes an act or state of 
war. Recent Russian academic and military commen- 
tary stresses the blurring of the distinction between 
war and peace, and asks to what extent this distinc- 
tion still exists. This suggestion of a shifting boundary 
between war and peace is directly relevant to consid- 
eration of at what point Russia considers itself to be at 
war and therefore subject to specific legal constraints 
on actions in cyberspace. 
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Conversely, actions that are considered innocent 
and friendly by the United States and European na- 
tions are parsed as hostile actions by Russia, leading 
to Russian attempts to outlaw "interference in another 
state's information space." The Russian notion of what 
constitutes a cyber weapon— or in Russian terminol- 
ogy, an information weapon— is radically different 
from our assumptions. 

Initiatives put forward by Russia for international 
cooperation on legal initiatives governing cyber activ- 
ity have received a mixed response from other states. 
But they need to be taken into account because of the 
alternative consensus on cyber security opposing the 
views of the United States and its close allies, which is 
growing as a result of an effective Russian program of 
ticking up support for Moscow's proposals from other 
countries around the world. 

This Letort Paper explores the Russian approach 
to legal constraints governing actions in cyberspace 
within the broader framework of the Russian under- 
standing of the nature of international law and com- 
mitments, with the aim of informing U.S. military and 
civilian policymakers of views held by a potential 
adversary in cyberspace. Using a Russian perspec- 
tive to examine the legal status of various activities 
in cyberspace, including what constitutes hostile 
activity, demonstrates that assumptions commonly 
held in the United States may need to be adjusted 
to counter effectively — or engage with— Russian 
cyber initiatives. 



LEGALITY IN CYBERSPACE: 
AN ADVERSARY VIEW 



INTRODUCTION 

The United States and its allies devote consider- 
able time and expense to considering the legal dimen- 
sions of cyber conflict. Although key definitions for 
establishing legality remain unresolved, such as what 
precisely constitutes an armed attack or use of force 
in cyberspace, the legal debates within and between 
Euro-Atlantic militaries are generally in harmony and 
derive from a broader legal consensus in these na- 
tions. This consensus holds that existing international 
law and international commitments are sufficient to 
regulate cyber conflict, and furthermore that certain 
individual rights in using cyberspace are inalienable. 

Authoritative legal commentaries, such as the Tal- 
linn Manual on the International Law Applicable to Cyber 
Warfare, released in early 2013,^ reflect this Western 
consensus. But they can misleadingly imply that this 
consensus is global and unchallenged. Significantly, 
the Manual does not include among its contributors 
any legal experts from nations considered potential 
adversaries in cyberspace, notably China and Russia. 

In fact, China, Russia, and a number of like-minded 
nations have an entirely different concept of the appli- 
cability of international law to cyberspace as a whole, 
including to the nature of conflict within it. These na- 
tions could therefore potentially operate in cyberspace 
according to entirely different understandings of what 
is permissible under international humanitarian law, 
the law of armed conflict, and other legal baskets gov- 
erning conduct during hostilities. 
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This Letort Paper will explore the Russian approach 
to legal constraints governing actions in cyberspace, 
within the broader framework of the Russian under- 
standing of the nature of international law and commit- 
ments, to inform U.S. military and civilian policymak- 
ers of views held by a potential adversary in cyberspace. 
It will examine the legal status of activities in cyber- 
space, including what constitutes hostile activity from 
a Russian perspective, to demonstrate that assump- 
tions commonly held in the United States may need to 
be adjusted effectively to counter — or engage with — 
Russian cyber initiatives. 

THE CYBER SECURITY SCHISM 

In conventional conflict, the legal constraints on 
combatants are clearly understood and well defined. 
Precisely when and how a state of war arises (jus ad 
helium) and how parties must conduct themselves dur- 
ing conflict (jus in hello) have been established through 
customary law and international legal commitments 
over the course of centuries. Generally accepted among 
developed nations, these principles give a degree of 
stability and predictability to the extent of armed con- 
flict, particularly in terms of legal constraints on col- 
lateral damage, proportionality, initiation of conflict, 
self-defense, and humanitarian impact. 

In cyberspace, no such consensus exists. This is be- 
cause the view of legality held by the United States 
and its allies is not a global one, and other key actors 
in cyberspace have an entirely different approach. It 
is therefore important for U.S. planners to understand 
that potential adversaries may be operating according 
to an entirely different set of assumptions regarding 
what is permissible behavior in cyberspace in terms of 
international law. 
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Descriptions of the state of regulation of activity 
in cyberspace as a whole are replete with metaphor. 
Establishing commonly agreed norms and rules of 
behavior for this new domain has been compared to 
the early days of nuclear weapons with no mutual 
understanding on the rules of deterrence, to the mo- 
tor car with no rules of the road, to the long devel- 
opment of international maritime law, and much else 
besides. A common perception is that online activity, 
and in particular hostile online activity, is so new a 
phenomenon that there should be little surprise that 
a commonly agreed regulatory framework is still a 
distant prospect. 

Despite the recent burgeoning of domestic and 
international legal debate over cyber issues, this per- 
ception of novelty is misplaced. Neither cyber conflict, 
nor the legal arguments over it, can remotely be de- 
scribed as a new concept. Among newcomers to cy- 
ber issues, it is commonly believed that the notion of 
introducing hostile code custom written by national- 
level experts into a secure facility on removable media 
in order to carry out a precisely targeted attack on a 
system through a supervisory control and data acqui- 
sition (SCAD A) interface is an entirely new and origi- 
nal idea never heard of before Stuxnet. Until, that is, 
they see the original British version of The Italian Job, 
where exactly the same process is described in a mo- 
tion picture released almost 40 years earlier. As stated 
by Jason Healey in his survey, "A Fierce Domain," 
which should be essential reading for anybody who 
believes that this is a new issue: 
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Many of the questions vexing cyber policymakers 
today were asked in exactly the same terms by their 
predecessors 10 and 20 years earlier. Again and again, 
lessons have been identified and forgotten rather than 
learned.^ 

Nevertheless, despite a Euro-Atlantic consensus on 
the broad principles of cyber conflict and use of the In- 
ternet, intense debate between legal practitioners con- 
tinues, with a marked increase in intensity following 
the recent prioritization of cyber issues in the United 
States and the United Kingdom (UK), and associated 
funding flows. Examples of recent legal scholarship 
published in the last 12 months alone include "Legal 
Implications of Territorial Sovereignty in Cyberspace" 
and "Law of Neutrality in Cyberspace" by leading 
German specialist Wolff Eleintschel Von Heinegg; "A 
Methodology for Cyber Operations Targeting and 
Control of Collateral Damage in the Context of Lawful 
Armed Conflict" by Robert Lanelli; studies examining 
the applicability of international law to terrorist acts 
committed through cyberspace;^ and many more. 

Yet all these works, as well as the Tallinn Manual 
referred to previously, reflect only a portion of the 
global debate over potential cyber law. Studying Rus- 
sian scholarship on "information warfare" (IW) and 
international agreements promoted by Russia with 
varying degrees of success provides an entirely dif- 
ferent view. Examination of the Shanghai Coopera- 
tion Organization (SCO) Information Security Treaty 
of 2009, or the draft International Code of Conduct 
in Cyberspace proposed in the United Nations (UN) 
jointly by Russia, China, Tajikistan, and Uzbekistan in 
2011, illustrates that different nations hold views di- 
vergent from those of the United States. 
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One key area of disagreement is whether online 
activity, and especially online conflict, is broadly gov- 
erned by existing international law, or whether en- 
tirely new legal instruments are needed to govern it. 
An objective assessment by two authoritative officers 
of the Organization for Cooperation and Security in 
Europe (OSCE) notes that "no universally accepted le- 
gal framework for dealing with cyber threats exists."^ 
This leads Russia, China, and others to call for what 
Hamadoun Toure, head of the International Telecom- 
munication Union (ITU) has described as: 

a treaty in which countries would promise to ensure 
Internet access for their citizens, protect them from at- 
tacks, work with other countries to stop criminal ac- 
tivities, and not attack another country first.® 

The United States, by contrast, argues that no such 
new document is necessary. The result is what Ger- 
man academic and practitioner Sandro Gaycken refers 
to as a "stalemate of norms. 

At the same time, the international information 
security debate has long been characterized by mu- 
tual blind spots. Unless directly engaged with Russia, 
China, or the ITU, many in the United States and al- 
lied policy or academic communities remain simply 
unaware that there is a view that diverges sharply 
from the one they are accustomed to. 

In part, this is because of the striking unanimity 
of view on the subject among English-speaking na- 
tions, where it is hard to identify any divergence in 
approach and underlying assumptions on the role and 
nature of cyber security. This deep consensus can give 
rise to a situation where even those experts with inter- 
national exposure can overlook the fact that this is not 
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the only possible view. For example, attendees at the 
launch of the Tallinn Manual referred to previously at 
the Royal Institute of International Affairs (Chatham 
House) in London, UK, in March 2013, heard the fol- 
lowing description of its universal acceptance: "The 
U.S., the UK, the EU [European Union], and NATO 
[North Atlantic Treaty Organization] all agree. Every- 
body agrees"^— rather overlooking that "everybody" 
includes substantially more nations with a very differ- 
ent approach to the subject. 

The broad divide between those states and orga- 
nizations that argue that new international law is re- 
quired to govern cyberspace and cyber conflict, and 
those that are satisfied with existing law, is a con- 
venient tool for explaining the broad sweep of the 
debate, but it masks complexities. For example, the 
Russian and Chinese approaches to the problem can 
appear superficially similar — sufficiently so for Russia 
and China to cooperate on drafting the "International 
Code of Conduct" referred to previously. But within 
this alternative consensus, there are nuances and vari- 
ations. As noted by Bertrand de La Chapelle, Direc- 
tor of the Internet & Jurisdiction Project at the Inter- 
national Diplomatic Academy in Paris and a Director 
on the Internet Corporation for Assigned Names and 
Numbers (ICANN) Board, although the debate on 
Internet governance; 

externally resembles an institutional battle . . . between 
institutions progressively put in place to ensure the 
growth of internet infrastructure, including ICANN, 
and the traditional multilateral system of the United 
Nations (UN) and its specialized agencies, including 
the International Telecommunications Union (ITU). . 

. . this vision is dangerous . . . and also erroneous and 
over-simplified. The approaches of the various actors 
are infinitely more complex.® 
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For this reason, the Russian approach to legality 
in cyberspace needs to be considered separately from 
that of China, the SCO, the Collective Security Trea- 
ty Organization, or any other state or organization 
whose views appear at first sight to chime with the 
Russian ones. 

Why Cyber Security Is Needed. 

In order to assess the Russian approach to what is 
and is not permissible in cyberspace, it is essential first 
to deal with a mismatch of fundamental notions of cy- 
ber security. Even before we approach the topic of ac- 
tual cyber conflict, the official Russian view is that cy- 
ber security overall is not about defending businesses 
and people, as we would understand it, but states and 
territories. So to understand the Russian viewpoint, 
we need to leave behind some of the basic assump- 
tions and principles about cyberspace stated by Euro- 
Atlantic governments. 

For the purpose of illustration, we can avoid well- 
known U.S. statements on cyber security and instead 
take Sweden as a case study. According to Swedish 
Ministry of Foreign Affairs officials from the Interna- 
tional Law and Eluman Rights Department; 

We analyze internet freedom within a human rights 
framework. . . . The foundation is basic human rights 
law: security needs to be arranged so as not to violate 
human rights law . . . Information security is to protect 
the individual, not governments. It's to protect you 
and me.^ 

This notion that human rights are a fundamental 
concern determining how the Internet should be man- 



7 



aged contrasts with the Russian approach voiced in 
public statements that security is an essential basis 
and other considerations are secondary. In fact, as will 
be discussed herein, specific activities that Sweden en- 
courages on the Internet are interpreted by Russia as 
hostile actions. 

Sweden is not the only country that disagrees with 
the Russian approach that security trumps all other 
considerations when using the Internet. The UK view 
is that economic issues are the foundation, and secu- 
rity has to be built around these; "Cyber is first about 
the economy and prosperity. National security and 
military security are not the most immediate concerns 
there."i° 

The overall UK assumption that cyber security is 
"to protect the individual, not governments" overlaps 
with, but does not equate to, the standard Russian 
formulation of security being about protection of the 
trinity of individual, society, and state. As will be 
seen in repeated examples throughout this Letort Pa- 
per, this balance of interests in the Russian perception 
leads to a highly distinctive Russian approach to what 
is permissible and legal in cyberspace. 

THE EURO-ATLANTIC CONSENSUS 

What follows is not a qualified legal opinion, but 
rather refers to a number of existing analyses to de- 
scribe a general consensus. This will provide context 
and contrast for the description of the Russian ap- 
proach that follows. 
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Cyber Warfare and International Law. 

Many current legal debates in the United States 
and allied countries over conflict in cyberspace cen- 
ter on the definition of an "armed attack" or "use of 
force," and how these definitions can be extended 
into cyberspace. This is because Article 2(4) of the UN 
Charter prohibits the threat or use of force (undefined) 
against the territorial integrity or political indepen- 
dence of any state — except (Article 51) in cases of self- 
defense against an armed attack (also undefined). The 
lack of clarity over what constitutes an armed attack 
in cyberspace raises complications in other spheres as 
well, such as its use in the North Atlantic Treaty as a 
criterion for collective action by NATO. 

Thus there is a basic gap in fundamental defini- 
tions for deciding what is, and is not, legal in cyber 
warfare. According to one detailed analysis of the 
existing law governing cyber conflict; 

Right now, no comprehensive international treaty 
exists to regulate cyber attacks. Consequently, states 
must practice law by analogy: either equating cyber 
attacks to traditional armed attacks and responding to 
them under the law of war or equating them to crimi- 
nal activity and dealing with them under domestic 
criminal laws.^^ 

But this is considered broadly satisfactory. Cus- 
tomary international law has come to take the view 
that armed attack requires a certain intensity, and a 
response in self-defense requires necessity and pro- 
portionality. Anticipatory self-defense is based on im- 
minence, but the burden of proof lies with the actor 
that responds in self-defense. Thus the lack of absolute 
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definition of hostile activity in cyberspace does not ex- 
onerate a state that has acted in a hostile manner: 

Every internationally wrongful act by a State gives 
rise to international responsibility. . . . Conduct con- 
sisting of an action or omission is imputed to a State 
under international law. . . . The basis of state respon- 
sibility will vary with the content of the international 
obligation. This may be a strict basis or the basis of 
risk in some circumstances, while in others it may in- 
volve malice or culpable negligence, or, conceivably, 
malice.^® 

So, it is argued: 

States have a right under international law to: 1. View 
and respond to cyber attacks as acts of war and not 
solely as criminal matters. 2. Use active, not just pas- 
sive, defenses against the computer networks in other 
states, that may or may not have initiated an attack, 
but have neglected their duty to prevent cyber attacks 
from within their borders.^ 

This latter point addresses an issue long thought con- 
tentious in cyberspace, namely responsibility for the 
actions of nonstate actors. In fact, nonstate actors who 
carry out hostile actions against foreign states (par- 
ticularly relevant in the case of Russia) are also pro- 
vided for by existing legal obligations. According to 
one analysis: 

Since it is not realistic to expect states to completely 
prevent armed attacks by non-state actors, the disposi- 
tive factor in evaluating state conduct is what a state 
does to address potential threats and whether it takes 
realistic steps to prevent the attack from occurring.^^ 
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States have a longstanding duty to prevent non- 
state actors from using their territory to commit cross- 
border attacks. Traditionally, this duty only required 
states to prevent illegal acts that the state knew about 
beforehand. However, this duty has evolved in re- 
sponse to international terrorism and now requires 
states to act against groups generally known to carry 
out illegal acts. In the realm of cyber warfare, this 
duty should be interpreted to require states to enact 
and enforce criminal laws to deter cross-border cyber 
attacks. This means that: 

Either states will live up to their duty and start enforc- 
ing criminal laws against attackers, or states will vio- 
late their duty, which will create a legal pathway for 
victim-states to hold them legally responsible for an 
attack without having to attribute it first. In effect, re- 
peated failure by a state to take criminal action against 
its attackers will result in it being declared a 'sanctu- 
ary state,' allowing other states to use active defens- 
es against cyber attacks originating from within its 
borders.^ 

By extension, another highly contentious issue, 
that of positive attribution of hostile cyber activity to 
identify the perpetrator and take appropriate respon- 
sive action against the correct target, is also addressed 
partially addressed in the case of nonstate actors: 

It is evident that victim-states may forcibly respond to 
armed attacks by non-state actors located in another 
state when host-states violate their duty to prevent 
those attacks. With cyber attacks, imputing state re- 
sponsibility in this manner provides states a legal path 
to utilize active defenses without having to conclu- 
sively attribute an attack to a state or its agents.^^ 
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In short, if a state "looks the other way when cyber 
attacks are conducted against rival states, it effectively 
breaches its duty to prevent them through its unwill- 
ingness to do anything to stop them, just as if it had 
approved the attacks."^® 

At the same time, in order for Law of Armed Con- 
flict (LOAC) to apply to a particular conflict, neither 
formal declaration of war nor recognition of a state 
of war is required. According to a detailed analysis 
of the legal status of cyber activity during the armed 
conflict in Georgia in 2008, this was subject to the re- 
quirements of LOAC "as from the actual opening of 
hostilities. An analysis of ethics applicable to cyber 
warfare agrees; 

Because the principle of forfeiture determines permis- 
sible responses to all interpersonal harm, the point at 
which kinetic and cyber-attacks constitute a just cause 
or casus belli is the same.^“ 

and continues by describing further analogies that can 
determine a casus belli: 

On the one hand, a person attempting or actively in- 
tending to murder through a series of harms known 
to be individually non-lethal but lethal in aggregate is 
liable to lethal force. On the other hand, successive cy- 
ber-intrusions that combine to merely weaken a state 
militarily and/or economically do not in themselves 
constitute a just cause for war.^^ 

As can be seen, the legal debate is complex and mul- 
tifaceted. By contrast, one Russian argument is that 
efforts should be made not to regulate cyber warfare, 
but to outlaw it altogether. 
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RUSSIAN VIEWS 



In contrast to the common Western view of the 
Internet as an enabler and facilitator, many Russian 
analysts, experts, and commentators are guided by 
a much better established perception of insecurity 
online, and a greater openness to considering the In- 
ternet as a vulnerability as well as an opportunity. 
The Russian intelligence services publicly stress the 
potential for a detrimental effect on national security 
arising from connection to the Internet.^^ According to 
Associate Professor of the Faculty of Electronic War- 
fare of the Russian Combined-Arms Academy Pavel 
Antonovich, not only does Russia risk seeing a: 

negative effect on how its national interests are safe- 
guarded [resulting from] improvements in the form of 
unlawful activity in the cybernetic . . . area, and in high 
technologies"— but these technologies themselves are 
a threat.^® Other authoritative writers in the presti- 
gious "Military Thought" journal stress not only the 
asymmetric effect of cyber attack on Russia — 

The information infrastructures of major powers such 
as the U.S. or the Russian Federation could be wrecked 
hopelessly by a single battalion of 600 "cyber fighters" 
after two years of training for a cyber attack and no 
more than $100 million in costs.^‘‘ 

Antonovich concluded by summarizing the impact 
on society and the state as a whole, over and above 
our preoccupation with the direct effect on specific 
targets; 

The damage done by cyber weapons may include 
man-made disasters at vital industrial, economic, 
power, and transportation facilities, financial collapse. 
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and systemic economic crisis. Besides, cyber weapons 
can cause government and military operations to spin 
completely out of control, leave the population de- 
moralized and disorientated, and set off widespread 
panic. 

The alarm voiced by the security services is not a 
new concern that has arrived with the rise of social 
media, but a persistent narrative since the first pub- 
lic debates on the subject in the mid-1990s, when the 
Internet as a whole was described by the Federal Se- 
curity Service (FSB, Russian secret police) as a threat 
to Russian national security. A consistent argument 
since that time has been that Russian connection to 
the "world information space ... is impossible with- 
out the comprehensive resolution of the problems of 
information security."^^ More recently, the perception 
of vulnerability to hostile activity using the medium 
of the Internet has become ever more acute; as argued 
in 2012, "this is not an empty scare — the cyberspace 
warfare is already on."^^ 

This perception of vulnerability lends even greater 
weight to the habitual Russian emphasis on interna- 
tional law being the essential framework underpin- 
ning all international activity.^® This accent on the pri- 
macy of law is typically much more prominent than in 
U.S. and allied statements, and although it does rest 
on a distinctive view of the nature of international 
law,^"^ it also in part explains the Russian persistence in 
seeking new international legal instruments govern- 
ing cyberspace. 

The Russian argument for a new "Convention on 
International Information Security," which would 
also govern aspects of what we would describe as 
cyber warfare, has been exhaustively deconstructed 
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elsewhere.^” The remainder of this section will ex- 
amine the underlying Russian ideas and preconcep- 
tions that illustrate points of divergence from U.S. 
and Euro-Atlantic approaches. This will be done in 
three distinct areas; domestic application of existing 
law; the military approach; and the results for how 
Russia's international legal initiatives are presented 
and received. 

Domestic Application. 

There is a widespread perception outside Russia 
that Internet use there is heavily censored, and that 
freedom of expression is suppressed as a result of a 
misguided and paranoid view among the Russian se- 
curity services that free speech constitutes a threat to 
the ruling regime. As always, the real picture is more 
complex and nuanced. 

An example of the distinctive nature of the Rus- 
sian approach, and the security considerations behind 
it, comes with the use of social media. Emphasis on 
freedom of expression as a human right causes some 
foreign observers to suffer an allergic reaction when 
exposed to official Russian statements that appear 
to call for regulation of expression on social media. 
These statements, while they may appear entirely 
rational within context, are received overseas in an 
environment in which freedom of expression is sac- 
rosanct, and which finds it inconceivable that social 
media, as a means of that expression, can be subject to 
restriction. 

This conviction is so deep that some nations take 
upon themselves a mission to assist this free expres- 
sion in other countries, regardless of whether this is in 
accordance with those countries' national law. Return- 
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ing to the case of Sweden, 20 percent of the Swedish 
overseas development budget is spent on "capacity 
building/ democracy support" — including "provid- 
ing tools needed to communicate successfully" in 
repressive environments and "providing encryption 
software for activists" to ensure this communication 
remains concealed from the national government and 
law enforcement authorities.^^ 

This is precisely the kind of interference in another 
state's "information space" that Russia views as hostile 
and wishes to proscribe through international agree- 
ments like the "Convention" referenced previously. 
At a UN disarmament conference in 2008, a Russian 
Ministry of Defence representative suggested that any 
time a government promoted ideas on the Internet 
with the intention of subverting another country's 
government, including in the name of democratic re- 
form, this would qualify as "aggression" and an inter- 
ference in internal affairs.^^ Yet at the same time, this 
is not construed by Sweden as a hostile act. According 
to Carl Fredrik Wettermark of the International Law 
and Human Rights Department, Swedish Ministry of 
Foreign Affairs (MFA), "there is no tension between 
democracy support — including encryption and com- 
munications provision— and working with the gov- 
ernments that the activists are opposing."^^ 

This fundamental contradiction arises in part 
because of an almost total lack of threat perception 
arising from social media among the Euro-Atlantic 
community. Fortunately, a case study is available to 
demonstrate why Russia and other nations are con- 
cerned over misuse of social media — or why, as ex- 
pressed by Major General Aleksey Moshkov of the 
Russian Ministry of Internal Affairs in late 2011, "so- 
cial networks, along with advantages, often bring a 
potential threat to the foundations of society. This is 
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the case of the uprising and civil war in Libya, where 
social media and online communication circumvent- 
ing government control played a key role in regime 
change. According to a study published by the U.S. 
Naval War College; 

Successful dispute of the government control of com- 
munications led to freedom of action in the cyber and 
land domains. This freedom of action led to traditional 
military support from the U.S. and NATO that ulti- 
mately allowed the opposition to achieve the physi- 
cal objectives of defeating the Gaddafi regime and the 
eventual election of a new government.® 

Translated to the context of Russian security con- 
cerns, this correlates to statements like the one by FSB 
First Deputy Director Sergei Smirnov in early 2012: 
"New technologies are used by Western secret servic- 
es to create and maintain a level of continual tension 
in society with serious intentions extending even to 
regime change. 

The view that political change in North Africa after 
the Arab Spring came about as a result of a Western 
IW and cyber conspiracy, which could then be imple- 
mented against Russia, fed into suspicion of foreign 
orchestration at the time of Russia's election protests 
in 2011-12, and was subsequently vindicated by anal- 
yses (like the one mentioned previously) of the role of 
social media in the Libyan civil war — which showed 
that they can be used not only for the espionage, 
subversion, and circumvention of communications 
restrictions suspected by Russia's security services, 
but also for other instruments of regime change, up to 
and including supplying targeting information for air- 
strikes.^® Assessment of Russian concerns over "mis- 
use" of social media needs to be placed in the context 
of this perception of existential threat. 
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A complicating factor that hinders understanding 
of the official Russian attitude to the legality of domes- 
tic Internet use is that policy statements on this and 
other issues differ widely depending on their source, 
giving rise to yet more incomprehension abroad. Of- 
ficials from bodies including the MFA, the Ministry 
of Internal Affairs, the Ministry of Communications, 
the FSB, the Security Council, and the Presidential Ad- 
ministration (the latter two, voiced through their aca- 
demic offshoots, the Institute of Information Security 
Issues and the Russian Institute for Strategic Studies, 
respectively) make pronouncements that rightly or 
wrongly are seen as voicing official Russian govern- 
ment policy, and which are mutually contradictory. 
For this reason and others, commercial entities in 
Russia and those following the topic overseas eagerly 
await the promised release of a new cyber security 
strategy, which should clarify at least some of the 
more controversial issues. 

When Russian proposals are reviewed overseas, a 
further perceived incompatibility arises between Rus- 
sian initiatives for international action on cyber secu- 
rity and Russia's own bad reputation as a permissive 
environment for cyber crime. A book published in 
2011 stated that: 

Given the strength of . . . comprehensive surveillance 
of the Internet, one might assume that Russia would 
represent an implacably hostile environment for cyber 
criminals. Yet the Russian Federation has become one 
of the great centers of global cybercrime. The strike 
rate of the police is lamentable, while the number of 
those convicted barely reaches double figures. 

The reason, while unspoken, is largely understood. 
Russian cyber criminals are free . . . provided the tar- 
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get of [their] attacks are located in Western Europe 

and the United States.^^ 

This statement appeared entirely uncontroversial 
because of a relative lack of publicity for recent Rus- 
sian efforts against cyber crime and the high profile of 
commercial entities, as opposed to law-enforcement 
agencies, in combating crime. The impression abroad 
persists, therefore, that there has been no change in 
the (at the very least) permissive attitude to cyber 
crime and to other forms of antisocial behavior online, 
including the activities of "patriotic hackers" carrying 
out destructive and criminal activity in foreign states 
such as Estonia and Georgia, activity that happens to 
coincide with the Russian state aims of the day. In- 
deed, Russia's perceived unwillingness to prosecute 
cyber crime against overseas targets has been put for- 
ward as a serious and plausible explanation for the 
concurrent unwillingness to join the Budapest Con- 
vention on Cybercrime.'^” 

The department of Russia's Ministry of Internal 
Affairs that deals with cyber crime is referred to as 
"Directorate K." Russia was slow to legislate against 
computer crime, and this department is, to some ex- 
tent, still hampered by inadequate and outdated leg- 
islation. Colonel General (Retired) Boris Nikolayevich 
Miroshnikov, the cultured and softly spoken first com- 
mander of Directorate K, explains that "our laws are 
not keeping up with the problems we are observing. . 
. . [Wje are the victims of our civil legal regulation not 
keeping up.'^^ 

In part, he says, this results from pursuing the 
economic benefits of the Internet while disregarding 
security concerns — echoing criticism by other Russian 
commentators of the Western approach to use of the 
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Internet. In addition, the pace of developing new laws 
is simply unable to keep up with the development of 
activity in cyberspace. "An event has to become a phe- 
nomenon, then we have to study it, then legislate — 
but we are in a legal lacuna between the old and new 
laws," Miroshnikov says.^^ The result is palpable frus- 
tration at the balance of legislation governing online 
activity, with officials citing the example of banks that 
have been victims of cyber crime responding to re- 
quests for information with the aim of assisting them, 
with a detailed legal explanation of why this informa- 
tion cannot be given due to legislation on commercial 
secrecy and protection of personal data. The situation 
is complicated still further by competition between 
Russian law enforcement agencies, investigators, and 
prosecutors, a situation referred to by Boris Mirosh- 
nikov as "departmental egoism."^^ 

New laws governing Internet usage have recently 
been passed in Russia. These laws tend to attract criti- 
cism from abroad. Both a July 2013 law on protection 
of intellectual property online, and the July 2012 "In- 
ternet blacklist" law setting up a "Single Register" of 
websites blocked because they are deemed threatening 
to minors, have been painted by activists and foreign 
media as state efforts to introduce Internet censorship 
on ostensibly economic and moral grounds — includ- 
ing, potentially, censorship of social media outlets.^'^ 
But it is misleading to present these laws solely as 
an initiative intended to stifle political dissent. They 
also variously meet international and domestic com- 
mercial obligations, and reflect a desire to preserve 
some elements of Russian cultural norms. Many more 
proposals for doing so have been raised in the Rus- 
sian legislative bodies but fallen flat on the grounds 
of impracticality, such as a draft law that would have 
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outlawed foul language on the Internetd^ The sugges- 
tion that legislation has been introduced at the request 
of President Putin to suppress dissent is undermined 
by the continuing proliferation of sometimes quite 
mordant anti-Putin satire onlined^ 

Detailed assessments of the impact, intended and 
unintended, of legislative initiatives is provided by 
the Russian Association for Electronic Communica- 
tions (RAEC), an industrial body that provides expert 
evaluations for draft laws and provides a voice for the 
Internet industry in shaping the regulatory pictured^ 
These assessments can differ markedly from the some- 
times overblown rhetoric of rights organizations and 
overseas media when discussing the same legislation. 

In addition, fears of sweeping powers to remove 
offending content from the Internet, if not misplaced, 
are perhaps mistimed: these powers were already 
available to the Russian authorities through legal and 
regulatory routes. Under the Federal law "On Police" 
dated 2011, Internet service providers can be instruct- 
ed to shut down an Internet resource on suspicion of 
providing "conditions which assist the commission of 
a crime or administrative violation," with no require- 
ment for the police to seek a court order. According 
to Russian domain name regulations, "the Registrar 
may terminate the domain name delegation on the 
basis of a decision in writing" by a senior law enforce- 
ment official — again, with no requirement for judicial 
oversight.'^^ 

Despite allegations that the Single Register has 
been used to censor or stifle views critical of the gov- 
ernment, the loudest criticism comes from those who 
note that it is a blunt instrument whose flawed imple- 
mentation has serious unintended consequences— for 
instance, blocking YouTube because a zombie make- 
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up instruction video is wrongly identified as pro- 
moting self-harm, or rendering Russia's most popu- 
lar search engine, Yandex, unavailable for almost 30 
minutes in late April 2013 due to its being accidentally 
added to the Register 

These criticisms are often directed at the Minis- 
try of Communications, as the body with ultimate 
supervisory authority for the Register. The Ministry 
response, far from the hard line that critics of Russia 
often assume, is that it is asking the Internet industry 
to self-regulate, and the Single Register is a mecha- 
nism for this — and furthermore, the Ministry should 
not be blamed, as it is only implementing a Federal 
law rather than its own regulations. 

It follows that the nature of control of freedom of 
expression online in Russia is more subtle and nu- 
anced than the heavy-handed censorship often de- 
scribed overseas, and it would be misleading to claim 
that the sole aim of recent legal initiatives is to sup- 
press dissent. At the same time, the fundamentally 
different Russian approach to the balance of rights 
and responsibilities online remains. The head of the 
Russian MFA's Department of New Challenges and 
Threats (which, naturally, includes cyber) — and Rus- 
sia's cyber ambassador — is Audrey Vladimirovich 
Krutskikh. In his view, the primacy of freedom of 
speech that is promoted by Western powers is a form 
of "extremism," and its damaging potential is in- 
compatible with freedom of access to the Internet.^^ 
Krutskikh uses the example of Boston police request- 
ing social media users not to broadcast police activi- 
ties in the aftermath of the Boston marathon bombing 
in April 2013“ to bolster his argument for the need to 
regulate freedom of expression in the interests of na- 
tional security.^^ Thus the distinctive official Russian 
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view of cyber security continues to be informed by a 
perception of threat from the Internet, and of the bal- 
ance of interest there, which is at odds with our own. 

Military Views. 

According to the former head of the Russian Gen- 
eral Staffs Main Operations Directorate, Lieutenant 
General Andrey Tretyak, there are now four "spaces 
for high-technology confrontation— space, land, air, 
and information."^^ When considering Russian ap- 
proaches to cyber, it is essential to remember the dif- 
ferent dividing lines between information operations 
and computer network operations that pertain to Rus- 
sian thinking, and the resulting references to "infor- 
mation space" rather than cyberspace.^^ 

Russian writing in open sources on the likely na- 
ture of online confrontation — including, for example, 
the Conceptual Views on the Activity of the Russian Fed- 
eration Armed Forces in Information Space, a document 
widely seen as the Russian military's cyber proto- 
doctrine — rarely fail to refer to the need to observe le- 
galities. For example, a 2012 essay on military thought 
regarding rules and principles governing this kind 
of conflict: 

If, however, a conflict heats up to a critical point, the 
Russian Armed Forces will exercise their right to in- 
dividual or collective self-defense and resort to any 
methods and weapons they choose, as long as they 
comply with the commonly accepted norms and prin- 
ciples of international law.®'’ 
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Yet over and above the issue of a specific Russian 
interpretation of existing international law, there is 
also the consideration of at what point Russia consid- 
ers itself to be at war and therefore subject to jus in hel- 
lo. Recent Russian commentary stresses the blurring 
of the distinction between war and peace, and asks to 
what extent this distinction still exists. Antonovich, 
cited previously, argues that cyberspace erodes this 
line and holds that actions in cyberspace are allowed 
without crossing the line to war. Significantly, he ar- 
gues that damaging cyber attacks can be carried out 
without a state of war existing or being triggered by 
the attack: 

Dividing lines between war and peace can be eroded 
conveniently in cyberspace. Damage (whatever its 
nature) can actually be done to an adversary with- 
out overstepping formally the line between war and 
peace.®^ 

This suggestion of a shifting boundary between 
war and peace is not restricted to academic circles: 
the same idea was voiced by Chief of General Staff 
Valeriy Gerasimov when he contended at a speech 
for the Academy of Military Sciences that the states 
of war and peace are now more of a continuum than 
distinct, and that new types of conflict other than war 
can have political results comparable to war.^® 

Gerasimov's argument is worth studying in detail, 
not only for its possible implications for cyber conflict, 
but also for understanding Russia's approach to the 
use of armed force overall. The new continuum of 
conflict is explained in detail by Vladimir Makhonin, 
a Russian historian who describes a hierarchy of con- 
flict where war is the ultimate stage but is preceded by 
armed conflict, which in its turn is preceded by social 
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conflict (defined as resolving, by a variety of means, 
extreme differences). In other words, social conflict 
and armed attack take their place as a stage of con- 
frontation that do not, according to this view, amount 
to war.^® 

The implications of this for cyber conflict are two- 
fold. First, any full-scale cyber conflict would, just 
as with conventional armed conflict, be preceded by 
smaller-scale attacks: 

It may be safely assumed that a large-scale external 
aggression aimed at seizing Russia's resources will be 
preceded by a series of conflicts {not necessarily armed 
ones) within the country. Increasing activity by various 
terrorist, ethnic separatist, extremist and other similar 
organizations will become a species of reconnaissance 
in force as the situation ripens for a large-scale war. 
Historical experience suggests that this kind of sce- 
nario is only too feasible.*^® 

Second, hostile information activity, including 
computer network operations, can be conducted out- 
side a state of war. According to an exceptional study 
of Russian views on information operations and IW 
by Sweden's Defence Research Agency (FOI): 

Regarding network and computer operations in peace- 
time IW, viruses and other malware are important in 
order to compromise the information assets of the en- 
gineering systems of the enemy. Other aspects of IW 
are accumulating (stealing) information on the enemy, 
by intelligence gathering, while developing and test- 
ing one's own IW weapons.®^ 

This is a departure from previous Russian views 
of the status of information warfare. In the mid-1990s. 
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leading experts Timothy L. Thomas and Lester Grau 
were able to write that: 

. . . from a military point, the view of Information 
Warfare against Russia or its armed forces will cat- 
egorically not be considered a non-military phase of 
a conflict whether it will be causalities or not . . . con- 
sidering the possible catastrophic use of information 
warfare means by an enemy, whether on economic or 
state command and control systems, or on the combat 
potential of the armed forces. . . . Russia retains the 
right to use nuclear weapons first against the means 
and forces of information warfare, and then against 
the aggressor state itself.® 

Three further specific features of current Russian 
views on when cyber force can legitimately be used 
need to be briefly considered. First, there is the nature 
of the threat perceived by Russia, its radical difference 
from Western threat perception, and its pervasive 
influence on decisionmaking. As noted by Stephen 
Blank and others, "We often underestimate the impact 
of the Russian leadership's perception that Russia is 
intrinsically at risk, and in some sense under attack 
from the West."^^ Second, and related to the first, there 
is Russian awareness of a capability gap with the 
threatening West, and the consequent need to respond 
asymmetrically. Norwegian analyst Tor Bukkvoll 
writes that: 

The idea of developing an asymmetric technological 
response — popular in many nations with more or less 
strained relations with the West— has become a truism 
among the Russian traditionalists. The main reason is 
the realization that the Western lead is too great to 
catch up with.® 
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Indeed, according to Vladimir Putin, Russia's 
responses to threats "are to be based on intellectual 
superiority. They will be asymmetrical, and less cost- 
ly."^® Third, there is the distinctive Russian perception 
of its relations with its smaller neighbors — including 
those that are commonly held to have been targets of 
Russian cyber attacks, Estonia and Georgia. A separate 
Norwegian study of Russian attitudes to the use of 
force was published in 2005, before any widely publi- 
cized cyber aggression was ascribed to Russia. But its 
conclusion regarding conventional intervention is just 
as valid for cyber: "It can be argued that Russian deci- 
sionmakers simply did not consider the former Soviet 
republics foreign in terms of cases of intervention."*’^ 

International Initiatives. 

Russia has persistently sought a new international 
legal instrument that would constrain activity in cy- 
berspace. The desire for this is driven by consider- 
ations described previously, including threat percep- 
tion, emphasis on the primacy of international law, 
and a Russian desire to constrain competitors by po- 
litical means while in a state of vulnerability arising 
from a capability gap.^^ There is also the traditional 
debate over the relative weight of the capabilities or 
the intentions of potential adversaries. For Andrey 
Krutskikh, the answer is clear: "Imagine that 120-130 
countries acquire the capability for cyber strikes — 
then the strikes will inevitably follow."^® This section 
will not list specific points of the Russian proposals, 
as this has been done in detail elsewhere:®® instead, it 
looks at how they are presented and received, and the 
implications of this for the United States and its allies. 
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There is an apparent paradox that some widely 
accepted international agreements are already avail- 
able, but not subscribed to by Russia. This is because, 
as drafted, they contain clauses that are unacceptable 
to the Russian authorities. As noted by OSCE experts 
Raphael Perl and Nemanja Malisevic, some states do 
have legitimate objections to clauses in instruments 
such as the Council of Europe's Convention on Cyber- 
crime 2001 (the Budapest Convention); "in reality . . . 
many states face challenges in becoming party to these 
conventions. 

Initiatives put forward by Russia for international 
cooperation in information security have received a 
mixed response from other states. In particular, over 
a period of years they have been consistently ignored 
or rejected by the United States, the UK, and other 
like-minded nations. This response is indicative of 
the huge remaining divide between the views and as- 
sumptions expressed in these Russian initiatives and 
the Euro-Atlantic presumptions, which are taken for 
granted by many of those reading them.^^ 

Experts involved in discussions with Russia, or 
analysis of their proposals, are able to engage in de- 
bate over their specific provisions, their acceptability 
to the United States and allies, and their practicality 
or otherwise. But remember that this international 
group with exposure to both sides of the argument 
is only a very small subset of the much larger group 
of individuals engaged with the issues as a whole. 
Many more officials, diplomats, policymakers, and 
advisers in Western nations will only be acquainted 
with their own side of the debate. The reaction to Rus- 
sian statements, actions, and policy initiatives from 
this group can include words like; unpredictable, 
unnecessarily uncooperative, incomprehensible, and 
frequently, irrational. 
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In part, this is because of the relative lack of visibil- 
ity abroad of key Russian proposals. Opportunities to 
bring the Russian ideas to broader notice appear often 
not to be taken. We can take as an example the Bu- 
dapest Conference on Cyberspace in October 2012, on 
the face of it a prime venue for explaining the Russian 
point of view to the world. Ahead of the conference, 
"International Cyber Documents" were provided for 
reference on its website, outlining national and inter- 
national approaches to cyber security— for example, 
the text of a speech by Swedish Foreign Minister Carl 
Billet, Australian and Canadian white papers and cy- 
ber security strategies, the Budapest Convention on 
Cybercrime, OECD recommendations, and NATO 
statements. Yet no Russian equivalent was provided. 
During the conference itself, just as at the London 
Conference on Cyberspace the previous year, a pre- 
sentation delivered in Russian failed to account for 
interpretation and therefore failed to put across key 
points at which the Russian view diverged from the 
Euro-Atlantic consensus on the nature of the Inter- 
net and rights and obligations in cyberspace. It was 
for this reason, among others, that many observers 
experienced considerable surprise when this consen- 
sus came face to face with the rest of the world at the 
World Conference on International Telecommunica- 
tions (WCIT) in Dubai in December 2012. 

A key lesson from WCIT for those who had not 
been following the debate was the extent of support 
for the viewpoint championed by Russia from those 
countries that share similar concerns about the cyber 
threat. Although Russian initiatives have been mostly 
discounted or ignored in the West, this is not their 
only audience, and Russia has been busy gathering 
support from other countries not usually considered 
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cyber powers, but with a perfectly valid vote in fora 
such as the ITU or the UN. This is possible because 
while many of the proposals appear counterintuitive, 
outdated, unworkable, or otherwise unacceptable to 
a Western audience, they appear comforting and rea- 
sonable in parts of the world that see a potential threat 
in the unrestricted circulation of information, includ- 
ing hostile and damaging information, both domesti- 
cally and internationally. 

At the same time, while many of the proposals for 
international agreement, and the assumptions about 
the nature of the Internet that underlie them, are in 
direct conflict with how the Euro-Atlantic community 
understands the Internet to work, they also conflict 
with the understanding of Russian Internet authori- 
ties themselves at a working level. For instance, a key 
principle of the Russian proposals is the concept of na- 
tional information space under state control. But this 
is not compatible with the work of Russian Internet 
service providers and domain authorities, unrelated 
to the state, who ensure the free circulation of infor- 
mation across borders on a daily basis, because this is 
a fundamental feature of the Internet. As stated on the 
website of the Russian Internet Governance Forum 
(RIGF), which took place in late April 2013: 

ttHTepHex aBJuieTCH Haa,rocya,apcxBeHHbiM o6pa- 
soBaHueM M, a,e- chaKxo, ue MMeex rpaHuu,. llMeHHO 
noaxoMy j\jm MHxepuexa xaK noa,xoa,ux Moa,ejib kojt- 
jieKXMBHoro ynpaBJiCHUH Cexbio (x.h. MyjibXMCxeuK- 
xojrn,epu3M) 

(The internet is a supra-governmental entity, and de 
facto has no borders. It is for this reason that the model 
of collective governance [so-called multistakehold- 
erism] is so suitable for the internet.)^^ 
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This is in direct contradiction to some key prin- 
ciples of Russian initiatives at a political level. 

The points mentioned thus far create an unforgiv- 
ing environment for positive reception of Russia's 
ideas on the nature and purpose of cyber security, 
and they contribute to the lack of meaningful debate 
on what precisely those ideas are. This leads to their 
rejection, either instinctive or reasoned, by Western 
liberal readers. Russia's proposed Draft Convention 
on International Information Security, as well as the 
International Code of Conduct proposed by Russia 
and other states in the UN, are the latest iteration of 
longstanding proposals but remain unacceptable to 
the Euro-Atlantic community. 

In fact, as explained by a Nordic diplomat speak- 
ing anonymously, some states deliberately avoid any 
use of the term "information security" in official state- 
ments because of its negative associations; even if the 
phrase is the most appropriate one to describe the 
topic under discussion, it has been sufficiently tainted 
by association with the regulatory stance adopted by 
Russia and China in particular, that it is shunned in 
favor of the more acceptable "cyber security." Mean- 
while, official representatives of other states that are 
deeply cautious about naming specific states as cyber 
security offenders overall can casually refer to Russia 
and China as the "worst adversaries" — not in cyber 
conflict, but in discussion over human rights.^'^ 

At a public level, examples abound of a total fail- 
ure to achieve not just dialogue, but also the level of 
mutual comprehension that would be its essential 
precursor. The dialogue of the deaf continues, with a 
failure on each side to appreciate how the other will 
perceive statements. This includes a lack of under- 
standing that policy taken as normal and uncontro- 



31 



versial in the West can appear threatening in Russia 
and in other parts of the world as well. For instance, 
when Giuseppe Abbamonte of the European Commis- 
sion's Directorate General for Communications Net- 
works, Content and Technology states publicly that a 
key part of the EU cyber security strategy is "engaging 
with third parties and making sure that we export our 
values," many of those hearing him will not take into 
account that substantial parts of the world do not wish 
to have their values exported from Brussels^^— and, 
in fact, precisely this kind of export is construed as a 
direct information security threat in Russia's Informa- 
tion Security Doctrine.^*’ 

The opposite also applies. Those following Rus- 
sian statements in the same field have to contend not 
only with the multiple and conflicting sources of ap- 
parent policy initiatives as described previously, but 
also with accompanying statements, which can leave 
them disinclined to take what they read seriously — as, 
for instance, with the following response to moves for 
improved protection of intellectual property online: 

Is the world about to allow the US and its surrogates to 
come after all of us? Apparently it is. The total enslave- 
ment of mankind will soon be here, brought to you by 
the fascist United Corporate States of America.^^ 

It is true that commentary in the media should 
not necessarily be taken as representative of an of- 
ficial Russian position, but this point is harder to 
argue when the name of the media outlet is "Voice 
of Russia." 

The result of this disconnect between radically dif- 
ferent approaches to the same issue can be compared 
to other areas of strategic contention between Russia 
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and the Euro-Atlantic community, such as Russia's 
proposals for a new European Security Treaty or Rus- 
sian objections to plans for basing missile defense 
systems in and around Europe. In all of these cases, 
the Russian position is based on considerations and 
assumptions that are wholly incompatible with reality 
as the European and North American audience under- 
stands it. The result, in many cases, is that what often 
seems the simplest and most appropriate response to 
them is not to engage with the incomprehensible Rus- 
sian view, but simply to ignore it and hope it will go 
away. Unfortunately, as can be seen from the other 
two longstanding examples given here, this tends not 
to happen. 

CONCLUSION 

The distinctive Russian approach to what is per- 
missible, and indeed moral, in cyberspace has impli- 
cations for U.S. policymakers in two key areas. First, 
there is consideration of the response to Russian and 
similar proposals for international agreements gov- 
erning cyberspace. As noted, in common with other 
longstanding Russian diplomatic initiatives, these 
proposals will remain in place regardless of whether 
their audience sees them as unworkable or indeed in- 
comprehensible. But unlike in previous years, it is no 
longer safe to broadly ignore them, due to the growing 
alternative consensus on cyber security that opposes 
the view of the United States and its close allies. Thus, 
if the United States wishes to see its own concept of 
Internet freedom to remain the dominant one, the dip- 
lomatic momentum that allowed a "formidable" U.S. 
delegation to attend WCIT needs to be maintained, 
and engagement needs to be fostered on a multilat- 
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eral basis to counter the effective Russian program of 
ticking up support for Moscow's proposals from other 
countries around the world. 

Second, there is the specific question of when, or 
whether, hostile action in cyberspace constitutes an act 
or state of war. On this point, Russian thinking appears 
at odds with the emerging Western consensus. This 
requires an expansion of study of law both within the 
U.S. military and in academia to include active consid- 
eration of the view from Russia and other dissenting 
nations. Achieving direct dialogue between the U.S. 
and Russian militaries, as well as with other agencies 
on the Russian side that would be engaged in cyber 
conflict, may be challenging but must be attempted. 
Confidence building measures to avert cyber conflict 
can expand on agreements reached between the Unit- 
ed States and Russia during June 2013 that were "ded- 
icated to assessing emerging ICT [information and 
communication technologies] threats and proposing 
concrete joint measures to address them,"^^ including 
provision for direct communications between national 
community emergency response teams (CERTs).^^ 

Finally, U.S. policymakers cannot afford to un- 
derestimate the extent to which Russian concepts 
and approaches differ from what they may take for 
granted. For instance, much effort has been devoted 
in the West to determining when a cyber weapon can 
legally be used.®° But when engaging in debate with 
Russia, we must consider that even the notion of what 
constitutes a cyber weapon— or in Russian terminol- 
ogy, an information weapon— will be radically differ- 
ent from our assumptions.® As put over a decade ago 
by the eminent scholar of Russian ways of thinking 
Timothy F. Thomas: 
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What is really different is the conceptual understand- 
ing of an information operation from a cultural, 
ideological, historical, scientific, and philosophical 
viewpoint. Different prisms of logic may offer totally 
different conclusions about an information operation's 
intent, purpose, lethality, or encroachment on sover- 
eignty; and this logic may result in new methods to 
attack targets in entirely non-traditional and creative 
ways.®^ 
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